Splunk Search

How to create a beautified time difference?

Motivator

We have the following code:

| stats count min(_time) as min, max(_time) as max by src, ....
| eval delta = (max - min)/(60*60*24)

How can we present this delta field as, let's say - 3 days, 2 hours, 16 minutes ?... or any other human readable way.

Path Finder

this answer is wrong. you are trying to strftime from milliseconds. although the result will show readable format, the values are invalid.

0 Karma

Contributor

Hi danielbb, try: | makeresults | eval mintime=1570466331.984 | eval maxtime=32890568331.784 | eval stime= round(maxtime-mintime,0) | eval timestr=strftime(stime,"%j days, %H hours, %M minutes, %S seconds")